+Article 24 1.

Article 24 1.

Financial entities shall include in their ICT business continuity policy referred to in Article 11(1) of Regulation (EU) 2022/2554 all of the following:

(a) 

a description of:

(i) 

the objectives of the ICT business continuity policy, including the interrelation of ICT and overall business continuity, and considering the results of the business impact analysis (BIA) referred to in Article 11(5) of Regulation (EU) 2022/2554;

(ii) 

the scope of the ICT business continuity arrangements, plans, procedures, and mechanisms, including limitations and exclusions;

(iii) 

the timeframe to be covered by the ICT business continuity arrangements, plans, procedures, and mechanisms;

(iv) 

the criteria to activate and deactivate ICT business continuity plans, ICT response and recovery plans, and crisis communications plans;

(b) 

provisions on:

(i) 

the governance and organisation to implement the ICT business continuity policy, including roles, responsibilities and escalation procedures ensuring that sufficient resources are available;

(ii) 

the alignment between the ICT business continuity plans and the overall business continuity plans, concerning at least all of the following:

(1) 

potential failure scenarios, including the scenarios referred to in Article 26(2) of this Regulation;

(2) 

recovery objectives, specifying that the financial entity shall be able to recover the operations of its critical or important functions after disruptions within a recovery time objective and a recovery point objective;

(iii) 

the development of ICT business continuity plans for severe business disruptions as part of those plans, and the prioritisation of ICT business continuity actions using a risk-based approach;

(iv) 

the development, testing and review of ICT response and recovery plans, in accordance with Articles 25 and 26 of this Regulation;

(v) 

the review of the effectiveness of the implemented ICT business continuity arrangements, plans, procedures and mechanisms, in accordance with Article 26 of this Regulation;

(vi) 

the alignment of the ICT business continuity policy to:

(1) 

the communication policy referred to in Article 14(2) of Regulation (EU) 2022/2554;

(2) 

the communication and crisis communication actions referred to in Article 11(2), point (e), of Regulation (EU) 2022/2554.

1. Prezentare generală

,

1.1 Referințe

1.2 Cerințe identificate

1.3 Standarde asociate

2. Cerințe identificate

Cerințe

3. Standarde asociate

Standarde